Thomas Woerner
parent
9d71c81438
commit
bcc3dc0c5a
699
iptables-1.3.5-secmark.patch
Normal file
699
iptables-1.3.5-secmark.patch
Normal file
@ -0,0 +1,699 @@
|
|||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.c iptables-1.3.5/extensions/libip6t_CONNSECMARK.c
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.c 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libip6t_CONNSECMARK.c 2006-09-07 15:09:40.000000000 +0200
|
||||||
|
@@ -0,0 +1,124 @@
|
||||||
|
+/*
|
||||||
|
+ * Shared library add-on to ip6tables to add CONNSECMARK target support.
|
||||||
|
+ *
|
||||||
|
+ * Based on the MARK and CONNMARK targets.
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
||||||
|
+ */
|
||||||
|
+#include <stdio.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+#include <stdlib.h>
|
||||||
|
+#include <getopt.h>
|
||||||
|
+#include <ip6tables.h>
|
||||||
|
+#include <linux/netfilter/xt_CONNSECMARK.h>
|
||||||
|
+
|
||||||
|
+#define PFX "CONNSECMARK target: "
|
||||||
|
+
|
||||||
|
+static void help(void)
|
||||||
|
+{
|
||||||
|
+ printf(
|
||||||
|
+"CONNSECMARK target v%s options:\n"
|
||||||
|
+" --save Copy security mark from packet to conntrack\n"
|
||||||
|
+" --restore Copy security mark from connection to packet\n"
|
||||||
|
+"\n",
|
||||||
|
+IPTABLES_VERSION);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct option opts[] = {
|
||||||
|
+ { "save", 0, 0, '1' },
|
||||||
|
+ { "restore", 0, 0, '2' },
|
||||||
|
+ { 0 }
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static int parse(int c, char **argv, int invert, unsigned int *flags,
|
||||||
|
+ const struct ip6t_entry *entry, struct ip6t_entry_target **target)
|
||||||
|
+{
|
||||||
|
+ struct xt_connsecmark_target_info *info =
|
||||||
|
+ (struct xt_connsecmark_target_info*)(*target)->data;
|
||||||
|
+
|
||||||
|
+ switch (c) {
|
||||||
|
+ case '1':
|
||||||
|
+ if (*flags & CONNSECMARK_SAVE)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Can't specify --save twice");
|
||||||
|
+ info->mode = CONNSECMARK_SAVE;
|
||||||
|
+ *flags |= CONNSECMARK_SAVE;
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ case '2':
|
||||||
|
+ if (*flags & CONNSECMARK_RESTORE)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Can't specify --restore twice");
|
||||||
|
+ info->mode = CONNSECMARK_RESTORE;
|
||||||
|
+ *flags |= CONNSECMARK_RESTORE;
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ default:
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void final_check(unsigned int flags)
|
||||||
|
+{
|
||||||
|
+ if (!flags)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
|
||||||
|
+
|
||||||
|
+ if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE))
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save "
|
||||||
|
+ "or --restore is allowed");
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print_connsecmark(struct xt_connsecmark_target_info *info)
|
||||||
|
+{
|
||||||
|
+ switch (info->mode) {
|
||||||
|
+ case CONNSECMARK_SAVE:
|
||||||
|
+ printf("save ");
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ case CONNSECMARK_RESTORE:
|
||||||
|
+ printf("restore ");
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ default:
|
||||||
|
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print(const struct ip6t_ip6 *ip,
|
||||||
|
+ const struct ip6t_entry_target *target, int numeric)
|
||||||
|
+{
|
||||||
|
+ struct xt_connsecmark_target_info *info =
|
||||||
|
+ (struct xt_connsecmark_target_info*)(target)->data;
|
||||||
|
+
|
||||||
|
+ printf("CONNSECMARK ");
|
||||||
|
+ print_connsecmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
|
||||||
|
+{
|
||||||
|
+ struct xt_connsecmark_target_info *info =
|
||||||
|
+ (struct xt_connsecmark_target_info*)target->data;
|
||||||
|
+
|
||||||
|
+ printf("--");
|
||||||
|
+ print_connsecmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct ip6tables_target connsecmark = {
|
||||||
|
+ .name = "CONNSECMARK",
|
||||||
|
+ .version = IPTABLES_VERSION,
|
||||||
|
+ .size = IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)),
|
||||||
|
+ .userspacesize = IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)),
|
||||||
|
+ .parse = &parse,
|
||||||
|
+ .help = &help,
|
||||||
|
+ .final_check = &final_check,
|
||||||
|
+ .print = &print,
|
||||||
|
+ .save = &save,
|
||||||
|
+ .extra_opts = opts
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+void _init(void)
|
||||||
|
+{
|
||||||
|
+ register_target6(&connsecmark);
|
||||||
|
+}
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.man iptables-1.3.5/extensions/libip6t_CONNSECMARK.man
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.man 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libip6t_CONNSECMARK.man 2006-09-07 15:09:40.000000000 +0200
|
||||||
|
@@ -0,0 +1,15 @@
|
||||||
|
+This module copies security markings from packets to connections
|
||||||
|
+(if unlabeled), and from connections back to packets (also only
|
||||||
|
+if unlabeled). Typically used in conjunction with SECMARK, it is
|
||||||
|
+only valid in the
|
||||||
|
+.B mangle
|
||||||
|
+table.
|
||||||
|
+.TP
|
||||||
|
+.B --save
|
||||||
|
+If the packet has a security marking, copy it to the connection
|
||||||
|
+if the connection is not marked.
|
||||||
|
+.TP
|
||||||
|
+.B --restore
|
||||||
|
+If the packet does not have a security marking, and the connection
|
||||||
|
+does, copy the security marking from the connection to the packet.
|
||||||
|
+
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.c iptables-1.3.5/extensions/libip6t_SECMARK.c
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.c 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libip6t_SECMARK.c 2006-09-07 15:09:32.000000000 +0200
|
||||||
|
@@ -0,0 +1,125 @@
|
||||||
|
+/*
|
||||||
|
+ * Shared library add-on to iptables to add SECMARK target support.
|
||||||
|
+ *
|
||||||
|
+ * Based on the MARK target.
|
||||||
|
+ *
|
||||||
|
+ * IPv6 version.
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
||||||
|
+ */
|
||||||
|
+#include <stdio.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+#include <stdlib.h>
|
||||||
|
+#include <getopt.h>
|
||||||
|
+#include <ip6tables.h>
|
||||||
|
+#include <linux/netfilter/xt_SECMARK.h>
|
||||||
|
+
|
||||||
|
+#define PFX "SECMARK target: "
|
||||||
|
+
|
||||||
|
+static void help(void)
|
||||||
|
+{
|
||||||
|
+ printf(
|
||||||
|
+"SECMARK target v%s options:\n"
|
||||||
|
+" --selctx value Set the SELinux security context\n"
|
||||||
|
+"\n",
|
||||||
|
+IPTABLES_VERSION);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct option opts[] = {
|
||||||
|
+ { "selctx", 1, 0, '1' },
|
||||||
|
+ { 0 }
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+/* Initialize the target. */
|
||||||
|
+static void init(struct ip6t_entry_target *t, unsigned int *nfcache)
|
||||||
|
+{ }
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * Function which parses command options; returns true if it
|
||||||
|
+ * ate an option.
|
||||||
|
+ */
|
||||||
|
+static int parse(int c, char **argv, int invert, unsigned int *flags,
|
||||||
|
+ const struct ip6t_entry *entry, struct ip6t_entry_target **target)
|
||||||
|
+{
|
||||||
|
+ struct xt_secmark_target_info *info =
|
||||||
|
+ (struct xt_secmark_target_info*)(*target)->data;
|
||||||
|
+
|
||||||
|
+ switch (c) {
|
||||||
|
+ case '1':
|
||||||
|
+ if (*flags & SECMARK_MODE_SEL)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Can't specify --selctx twice");
|
||||||
|
+ info->mode = SECMARK_MODE_SEL;
|
||||||
|
+
|
||||||
|
+ if (strlen(optarg) > SECMARK_SELCTX_MAX-1)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Maximum length %u exceeded by --selctx"
|
||||||
|
+ " parameter (%zu)",
|
||||||
|
+ SECMARK_SELCTX_MAX-1, strlen(optarg));
|
||||||
|
+
|
||||||
|
+ strcpy(info->u.sel.selctx, optarg);
|
||||||
|
+ *flags |= SECMARK_MODE_SEL;
|
||||||
|
+ break;
|
||||||
|
+ default:
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void final_check(unsigned int flags)
|
||||||
|
+{
|
||||||
|
+ if (!flags)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print_secmark(struct xt_secmark_target_info *info)
|
||||||
|
+{
|
||||||
|
+ switch (info->mode) {
|
||||||
|
+ case SECMARK_MODE_SEL:
|
||||||
|
+ printf("selctx %s ", info->u.sel.selctx);\
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ default:
|
||||||
|
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print(const struct ip6t_ip6 *ip,
|
||||||
|
+ const struct ip6t_entry_target *target, int numeric)
|
||||||
|
+{
|
||||||
|
+ struct xt_secmark_target_info *info =
|
||||||
|
+ (struct xt_secmark_target_info*)(target)->data;
|
||||||
|
+
|
||||||
|
+ printf("SECMARK ");
|
||||||
|
+ print_secmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/* Saves the target info in parsable form to stdout. */
|
||||||
|
+static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
|
||||||
|
+{
|
||||||
|
+ struct xt_secmark_target_info *info =
|
||||||
|
+ (struct xt_secmark_target_info*)target->data;
|
||||||
|
+
|
||||||
|
+ printf("--");
|
||||||
|
+ print_secmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct ip6tables_target secmark = {
|
||||||
|
+ .name = "SECMARK",
|
||||||
|
+ .version = IPTABLES_VERSION,
|
||||||
|
+ .size = IP6T_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||||
|
+ .userspacesize = IP6T_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||||
|
+ .help = &help,
|
||||||
|
+ .init = &init,
|
||||||
|
+ .parse = &parse,
|
||||||
|
+ .final_check = &final_check,
|
||||||
|
+ .print = &print,
|
||||||
|
+ .save = &save,
|
||||||
|
+ .extra_opts = opts
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+void _init(void)
|
||||||
|
+{
|
||||||
|
+ register_target6(&secmark);
|
||||||
|
+}
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.man iptables-1.3.5/extensions/libip6t_SECMARK.man
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.man 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libip6t_SECMARK.man 2006-09-07 15:09:32.000000000 +0200
|
||||||
|
@@ -0,0 +1,7 @@
|
||||||
|
+This is used to set the security mark value associated with the
|
||||||
|
+packet for use by security subsystems such as SELinux. It is only
|
||||||
|
+valid in the
|
||||||
|
+.B mangle
|
||||||
|
+table.
|
||||||
|
+.TP
|
||||||
|
+.BI "--selctx " "security_context"
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.c iptables-1.3.5/extensions/libipt_CONNSECMARK.c
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.c 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libipt_CONNSECMARK.c 2006-09-07 15:09:36.000000000 +0200
|
||||||
|
@@ -0,0 +1,126 @@
|
||||||
|
+/*
|
||||||
|
+ * Shared library add-on to iptables to add CONNSECMARK target support.
|
||||||
|
+ *
|
||||||
|
+ * Based on the MARK and CONNMARK targets.
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
||||||
|
+ */
|
||||||
|
+#include <stdio.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+#include <stdlib.h>
|
||||||
|
+#include <getopt.h>
|
||||||
|
+#include <iptables.h>
|
||||||
|
+#include <linux/netfilter/xt_CONNSECMARK.h>
|
||||||
|
+
|
||||||
|
+#define PFX "CONNSECMARK target: "
|
||||||
|
+
|
||||||
|
+static void help(void)
|
||||||
|
+{
|
||||||
|
+ printf(
|
||||||
|
+"CONNSECMARK target v%s options:\n"
|
||||||
|
+" --save Copy security mark from packet to conntrack\n"
|
||||||
|
+" --restore Copy security mark from connection to packet\n"
|
||||||
|
+"\n",
|
||||||
|
+IPTABLES_VERSION);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct option opts[] = {
|
||||||
|
+ { "save", 0, 0, '1' },
|
||||||
|
+ { "restore", 0, 0, '2' },
|
||||||
|
+ { 0 }
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static int parse(int c, char **argv, int invert, unsigned int *flags,
|
||||||
|
+ const struct ipt_entry *entry, struct ipt_entry_target **target)
|
||||||
|
+{
|
||||||
|
+ struct xt_connsecmark_target_info *info =
|
||||||
|
+ (struct xt_connsecmark_target_info*)(*target)->data;
|
||||||
|
+
|
||||||
|
+ switch (c) {
|
||||||
|
+ case '1':
|
||||||
|
+ if (*flags & CONNSECMARK_SAVE)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Can't specify --save twice");
|
||||||
|
+ info->mode = CONNSECMARK_SAVE;
|
||||||
|
+ *flags |= CONNSECMARK_SAVE;
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ case '2':
|
||||||
|
+ if (*flags & CONNSECMARK_RESTORE)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Can't specify --restore twice");
|
||||||
|
+ info->mode = CONNSECMARK_RESTORE;
|
||||||
|
+ *flags |= CONNSECMARK_RESTORE;
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ default:
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void final_check(unsigned int flags)
|
||||||
|
+{
|
||||||
|
+ if (!flags)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
|
||||||
|
+
|
||||||
|
+ if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE))
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save "
|
||||||
|
+ "or --restore is allowed");
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print_connsecmark(struct xt_connsecmark_target_info *info)
|
||||||
|
+{
|
||||||
|
+ switch (info->mode) {
|
||||||
|
+ case CONNSECMARK_SAVE:
|
||||||
|
+ printf("save ");
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ case CONNSECMARK_RESTORE:
|
||||||
|
+ printf("restore ");
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ default:
|
||||||
|
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print(const struct ipt_ip *ip,
|
||||||
|
+ const struct ipt_entry_target *target, int numeric)
|
||||||
|
+{
|
||||||
|
+ struct xt_connsecmark_target_info *info =
|
||||||
|
+ (struct xt_connsecmark_target_info*)(target)->data;
|
||||||
|
+
|
||||||
|
+ printf("CONNSECMARK ");
|
||||||
|
+ print_connsecmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
|
||||||
|
+{
|
||||||
|
+ struct xt_connsecmark_target_info *info =
|
||||||
|
+ (struct xt_connsecmark_target_info*)target->data;
|
||||||
|
+
|
||||||
|
+ printf("--");
|
||||||
|
+ print_connsecmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct iptables_target connsecmark = {
|
||||||
|
+ .next = NULL,
|
||||||
|
+ .name = "CONNSECMARK",
|
||||||
|
+ .version = IPTABLES_VERSION,
|
||||||
|
+ .revision = 0,
|
||||||
|
+ .size = IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
|
||||||
|
+ .userspacesize = IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
|
||||||
|
+ .parse = &parse,
|
||||||
|
+ .help = &help,
|
||||||
|
+ .final_check = &final_check,
|
||||||
|
+ .print = &print,
|
||||||
|
+ .save = &save,
|
||||||
|
+ .extra_opts = opts
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+void _init(void)
|
||||||
|
+{
|
||||||
|
+ register_target(&connsecmark);
|
||||||
|
+}
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.man iptables-1.3.5/extensions/libipt_CONNSECMARK.man
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.man 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libipt_CONNSECMARK.man 2006-09-07 15:09:36.000000000 +0200
|
||||||
|
@@ -0,0 +1,15 @@
|
||||||
|
+This module copies security markings from packets to connections
|
||||||
|
+(if unlabeled), and from connections back to packets (also only
|
||||||
|
+if unlabeled). Typically used in conjunction with SECMARK, it is
|
||||||
|
+only valid in the
|
||||||
|
+.B mangle
|
||||||
|
+table.
|
||||||
|
+.TP
|
||||||
|
+.B --save
|
||||||
|
+If the packet has a security marking, copy it to the connection
|
||||||
|
+if the connection is not marked.
|
||||||
|
+.TP
|
||||||
|
+.B --restore
|
||||||
|
+If the packet does not have a security marking, and the connection
|
||||||
|
+does, copy the security marking from the connection to the packet.
|
||||||
|
+
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.c iptables-1.3.5/extensions/libipt_SECMARK.c
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.c 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libipt_SECMARK.c 2006-09-07 15:09:24.000000000 +0200
|
||||||
|
@@ -0,0 +1,125 @@
|
||||||
|
+/*
|
||||||
|
+ * Shared library add-on to iptables to add SECMARK target support.
|
||||||
|
+ *
|
||||||
|
+ * Based on the MARK target.
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
||||||
|
+ */
|
||||||
|
+#include <stdio.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+#include <stdlib.h>
|
||||||
|
+#include <getopt.h>
|
||||||
|
+#include <iptables.h>
|
||||||
|
+#include <linux/netfilter/xt_SECMARK.h>
|
||||||
|
+
|
||||||
|
+#define PFX "SECMARK target: "
|
||||||
|
+
|
||||||
|
+static void help(void)
|
||||||
|
+{
|
||||||
|
+ printf(
|
||||||
|
+"SECMARK target v%s options:\n"
|
||||||
|
+" --selctx value Set the SELinux security context\n"
|
||||||
|
+"\n",
|
||||||
|
+IPTABLES_VERSION);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct option opts[] = {
|
||||||
|
+ { "selctx", 1, 0, '1' },
|
||||||
|
+ { 0 }
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+/* Initialize the target. */
|
||||||
|
+static void init(struct ipt_entry_target *t, unsigned int *nfcache)
|
||||||
|
+{ }
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * Function which parses command options; returns true if it
|
||||||
|
+ * ate an option.
|
||||||
|
+ */
|
||||||
|
+static int parse(int c, char **argv, int invert, unsigned int *flags,
|
||||||
|
+ const struct ipt_entry *entry, struct ipt_entry_target **target)
|
||||||
|
+{
|
||||||
|
+ struct xt_secmark_target_info *info =
|
||||||
|
+ (struct xt_secmark_target_info*)(*target)->data;
|
||||||
|
+
|
||||||
|
+ switch (c) {
|
||||||
|
+ case '1':
|
||||||
|
+ if (*flags & SECMARK_MODE_SEL)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Can't specify --selctx twice");
|
||||||
|
+ info->mode = SECMARK_MODE_SEL;
|
||||||
|
+
|
||||||
|
+ if (strlen(optarg) > SECMARK_SELCTX_MAX-1)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX
|
||||||
|
+ "Maximum length %u exceeded by --selctx"
|
||||||
|
+ " parameter (%zu)",
|
||||||
|
+ SECMARK_SELCTX_MAX-1, strlen(optarg));
|
||||||
|
+
|
||||||
|
+ strcpy(info->u.sel.selctx, optarg);
|
||||||
|
+ *flags |= SECMARK_MODE_SEL;
|
||||||
|
+ break;
|
||||||
|
+ default:
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void final_check(unsigned int flags)
|
||||||
|
+{
|
||||||
|
+ if (!flags)
|
||||||
|
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print_secmark(struct xt_secmark_target_info *info)
|
||||||
|
+{
|
||||||
|
+ switch (info->mode) {
|
||||||
|
+ case SECMARK_MODE_SEL:
|
||||||
|
+ printf("selctx %s ", info->u.sel.selctx);\
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
+ default:
|
||||||
|
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static void print(const struct ipt_ip *ip,
|
||||||
|
+ const struct ipt_entry_target *target, int numeric)
|
||||||
|
+{
|
||||||
|
+ struct xt_secmark_target_info *info =
|
||||||
|
+ (struct xt_secmark_target_info*)(target)->data;
|
||||||
|
+
|
||||||
|
+ printf("SECMARK ");
|
||||||
|
+ print_secmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/* Saves the target info in parsable form to stdout. */
|
||||||
|
+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
|
||||||
|
+{
|
||||||
|
+ struct xt_secmark_target_info *info =
|
||||||
|
+ (struct xt_secmark_target_info*)target->data;
|
||||||
|
+
|
||||||
|
+ printf("--");
|
||||||
|
+ print_secmark(info);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct iptables_target secmark = {
|
||||||
|
+ .next = NULL,
|
||||||
|
+ .name = "SECMARK",
|
||||||
|
+ .version = IPTABLES_VERSION,
|
||||||
|
+ .revision = 0,
|
||||||
|
+ .size = IPT_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||||
|
+ .userspacesize = IPT_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||||
|
+ .help = &help,
|
||||||
|
+ .init = &init,
|
||||||
|
+ .parse = &parse,
|
||||||
|
+ .final_check = &final_check,
|
||||||
|
+ .print = &print,
|
||||||
|
+ .save = &save,
|
||||||
|
+ .extra_opts = opts
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+void _init(void)
|
||||||
|
+{
|
||||||
|
+ register_target(&secmark);
|
||||||
|
+}
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.man iptables-1.3.5/extensions/libipt_SECMARK.man
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.man 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ iptables-1.3.5/extensions/libipt_SECMARK.man 2006-09-07 15:09:24.000000000 +0200
|
||||||
|
@@ -0,0 +1,7 @@
|
||||||
|
+This is used to set the security mark value associated with the
|
||||||
|
+packet for use by security subsystems such as SELinux. It is only
|
||||||
|
+valid in the
|
||||||
|
+.B mangle
|
||||||
|
+table.
|
||||||
|
+.TP
|
||||||
|
+.BI "--selctx " "security_context"
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/extensions/Makefile iptables-1.3.5/extensions/Makefile
|
||||||
|
--- iptables-1.3.5.no_secmark/extensions/Makefile 2006-09-07 14:48:35.000000000 +0200
|
||||||
|
+++ iptables-1.3.5/extensions/Makefile 2006-09-07 15:09:40.000000000 +0200
|
||||||
|
@@ -8,6 +8,11 @@
|
||||||
|
PF_EXT_SLIB:=ah addrtype comment connlimit connmark conntrack dscp ecn esp hashlimit helper icmp iprange length limit mac mark multiport owner physdev pkttype policy realm rpc sctp standard state tcp tcpmss tos ttl udp unclean CLASSIFY CONNMARK DNAT DSCP ECN LOG MARK MASQUERADE MIRROR NETMAP NFQUEUE NOTRACK REDIRECT REJECT SAME SNAT TARPIT TCPMSS TOS TRACE TTL ULOG
|
||||||
|
PF6_EXT_SLIB:=connmark eui64 hl icmpv6 length limit mac mark multiport owner physdev policy standard state tcp udp CONNMARK HL LOG NFQUEUE MARK TRACE
|
||||||
|
|
||||||
|
+ifeq ($(DO_SELINUX), 1)
|
||||||
|
+PF_EXT_SE_SLIB:=SECMARK CONNSECMARK
|
||||||
|
+PF6_EXT_SE_SLIB:=SECMARK CONNSECMARK
|
||||||
|
+endif
|
||||||
|
+
|
||||||
|
# Optionals
|
||||||
|
PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
|
||||||
|
PF6_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test6),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
|
||||||
|
@@ -43,26 +48,34 @@
|
||||||
|
|
||||||
|
ifndef NO_SHARED_LIBS
|
||||||
|
SHARED_LIBS+=$(foreach T,$(PF_EXT_SLIB),extensions/libipt_$(T).so)
|
||||||
|
+SHARED_SE_LIBS+=$(foreach T,$(PF_EXT_SE_SLIB),extensions/libipt_$(T).so)
|
||||||
|
EXTRA_INSTALLS+=$(foreach T, $(PF_EXT_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libipt_$(T).so)
|
||||||
|
+EXTRA_INSTALLS+=$(foreach T, $(PF_EXT_SE_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libipt_$(T).so)
|
||||||
|
|
||||||
|
ifeq ($(DO_IPV6), 1)
|
||||||
|
SHARED_LIBS+=$(foreach T,$(PF6_EXT_SLIB),extensions/libip6t_$(T).so)
|
||||||
|
+SHARED_SE_LIBS+=$(foreach T,$(PF6_EXT_SE_SLIB),extensions/libip6t_$(T).so)
|
||||||
|
EXTRA_INSTALLS+=$(foreach T, $(PF6_EXT_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libip6t_$(T).so)
|
||||||
|
+EXTRA_INSTALLS+=$(foreach T, $(PF6_EXT_SE_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libip6t_$(T).so)
|
||||||
|
endif
|
||||||
|
else # NO_SHARED_LIBS
|
||||||
|
EXT_OBJS+=$(foreach T,$(PF_EXT_SLIB),extensions/libipt_$(T).o)
|
||||||
|
+EXT_OBJS+=$(foreach T,$(PF_EXT_SE_SLIB),extensions/libipt_$(T).o)
|
||||||
|
EXT_FUNC+=$(foreach T,$(PF_EXT_SLIB),ipt_$(T))
|
||||||
|
+EXT_FUNC+=$(foreach T,$(PF_EXT_SE_SLIB),ipt_$(T))
|
||||||
|
EXT_OBJS+= extensions/initext.o
|
||||||
|
ifeq ($(DO_IPV6), 1)
|
||||||
|
EXT6_OBJS+=$(foreach T,$(PF6_EXT_SLIB),extensions/libip6t_$(T).o)
|
||||||
|
+EXT6_OBJS+=$(foreach T,$(PF6_EXT_SE_SLIB),extensions/libip6t_$(T).o)
|
||||||
|
EXT6_FUNC+=$(foreach T,$(PF6_EXT_SLIB),ip6t_$(T))
|
||||||
|
+EXT6_FUNC+=$(foreach T,$(PF6_EXT_SE_SLIB),ip6t_$(T))
|
||||||
|
EXT6_OBJS+= extensions/initext6.o
|
||||||
|
endif # DO_IPV6
|
||||||
|
endif # NO_SHARED_LIBS
|
||||||
|
|
||||||
|
ifndef TOPLEVEL_INCLUDED
|
||||||
|
local:
|
||||||
|
- cd .. && $(MAKE) $(SHARED_LIBS)
|
||||||
|
+ cd .. && $(MAKE) $(SHARED_LIBS) $(SHARED_SE_LIBS)
|
||||||
|
endif
|
||||||
|
|
||||||
|
ifdef NO_SHARED_LIBS
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/Makefile iptables-1.3.5/Makefile
|
||||||
|
--- iptables-1.3.5.no_secmark/Makefile 2006-09-07 14:48:34.000000000 +0200
|
||||||
|
+++ iptables-1.3.5/Makefile 2006-09-07 15:08:41.000000000 +0200
|
||||||
|
@@ -31,6 +31,11 @@
|
||||||
|
DO_IPV6:=1
|
||||||
|
endif
|
||||||
|
|
||||||
|
+# Enable linking to libselinux via enviornment 'DO_SELINUX=1'
|
||||||
|
+ifndef DO_SELINUX
|
||||||
|
+DO_SELINUX=0
|
||||||
|
+endif
|
||||||
|
+
|
||||||
|
COPT_FLAGS:=-O2
|
||||||
|
CFLAGS:=$(COPT_FLAGS) -Wall -Wunused -I$(KERNEL_DIR)/include -Iinclude/ -DIPTABLES_VERSION=\"$(IPTABLES_VERSION)\" #-g -DDEBUG #-pg # -DIPTC_DEBUG
|
||||||
|
|
||||||
|
@@ -93,17 +98,24 @@
|
||||||
|
|
||||||
|
ifndef NO_SHARED_LIBS
|
||||||
|
DEPFILES = $(SHARED_LIBS:%.so=%.d)
|
||||||
|
+DEPFILES += $(SHARED_SE_LIBS:%.so=%.d)
|
||||||
|
SH_CFLAGS:=$(CFLAGS) -fPIC
|
||||||
|
STATIC_LIBS =
|
||||||
|
STATIC6_LIBS =
|
||||||
|
LDFLAGS = -rdynamic
|
||||||
|
LDLIBS = -ldl
|
||||||
|
+ifeq ($(DO_SELINUX), 1)
|
||||||
|
+LDLIBS += -lselinux
|
||||||
|
+endif
|
||||||
|
else
|
||||||
|
DEPFILES = $(EXT_OBJS:%.o=%.d)
|
||||||
|
STATIC_LIBS = extensions/libext.a
|
||||||
|
STATIC6_LIBS = extensions/libext6.a
|
||||||
|
LDFLAGS = -static
|
||||||
|
LDLIBS =
|
||||||
|
+ifeq ($(DO_SELINUX), 1)
|
||||||
|
+LDLIBS += -lselinux
|
||||||
|
+endif
|
||||||
|
endif
|
||||||
|
|
||||||
|
.PHONY: default
|
||||||
|
diff -urN iptables-1.3.5.no_secmark/Rules.make iptables-1.3.5/Rules.make
|
||||||
|
--- iptables-1.3.5.no_secmark/Rules.make 2006-09-07 14:48:36.000000000 +0200
|
||||||
|
+++ iptables-1.3.5/Rules.make 2006-09-07 15:08:04.000000000 +0200
|
||||||
|
@@ -1,12 +1,12 @@
|
||||||
|
#! /usr/bin/make
|
||||||
|
|
||||||
|
-all: $(SHARED_LIBS) $(EXTRAS)
|
||||||
|
+all: $(SHARED_LIBS) $(SHARED_SE_LIBS) $(EXTRAS)
|
||||||
|
|
||||||
|
experimental: $(EXTRAS_EXP)
|
||||||
|
|
||||||
|
# Have to handle extensions which no longer exist.
|
||||||
|
clean: $(EXTRA_CLEANS)
|
||||||
|
- rm -f $(SHARED_LIBS) $(EXTRAS) $(EXTRAS_EXP) $(SHARED_LIBS:%.so=%_sh.o)
|
||||||
|
+ rm -f $(SHARED_LIBS) $(SHARED_SE_LIBS) $(EXTRAS) $(EXTRAS_EXP) $(SHARED_LIBS:%.so=%_sh.o) $(SHARED_SE_LIBS:%.so=%_sh.o)
|
||||||
|
rm -f extensions/initext.c extensions/initext6.c
|
||||||
|
@find . -name '*.[ao]' -o -name '*.so' | xargs rm -f
|
||||||
|
|
||||||
|
@@ -33,6 +33,13 @@
|
||||||
|
$(SHARED_LIBS): %.so : %_sh.o
|
||||||
|
$(CC) -shared $(EXT_LDFLAGS) -o $@ $<
|
||||||
|
|
||||||
|
+$(SHARED_SE_LIBS:%.so=%.d): %.d: %.c
|
||||||
|
+ @-$(CC) -M -MG $(CFLAGS) $< | \
|
||||||
|
+ sed -e 's@^.*\.o:@$*.d $*_sh.o:@' > $@
|
||||||
|
+
|
||||||
|
+$(SHARED_SE_LIBS): %.so : %_sh.o
|
||||||
|
+ $(LD) -shared $(EXT_LDFLAGS) -o $@ $< $(LDLIBS)
|
||||||
|
+
|
||||||
|
%_sh.o : %.c
|
||||||
|
$(CC) $(SH_CFLAGS) -o $@ -c $<
|
||||||
|
|
||||||
@ -3,7 +3,7 @@
|
|||||||
Name: iptables
|
Name: iptables
|
||||||
Summary: Tools for managing Linux kernel packet filtering capabilities.
|
Summary: Tools for managing Linux kernel packet filtering capabilities.
|
||||||
Version: 1.3.5
|
Version: 1.3.5
|
||||||
Release: 1.2.1
|
Release: 2
|
||||||
Source: http://www.netfilter.org/%{name}-%{version}.tar.bz2
|
Source: http://www.netfilter.org/%{name}-%{version}.tar.bz2
|
||||||
Source1: iptables.init
|
Source1: iptables.init
|
||||||
Source2: iptables-config
|
Source2: iptables-config
|
||||||
@ -14,11 +14,13 @@ Patch6: iptables-1.2.10-counters.patch
|
|||||||
Patch8: iptables-1.3.0-cleanup.patch
|
Patch8: iptables-1.3.0-cleanup.patch
|
||||||
Patch9: iptables-1.3.0-autoload.patch
|
Patch9: iptables-1.3.0-autoload.patch
|
||||||
Patch10: iptables-1.3.0-no_root.patch
|
Patch10: iptables-1.3.0-no_root.patch
|
||||||
|
Patch11: iptables-1.3.5-secmark.patch
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
URL: http://www.netfilter.org/
|
URL: http://www.netfilter.org/
|
||||||
BuildRoot: %{_tmppath}/%{name}-buildroot
|
BuildRoot: %{_tmppath}/%{name}-buildroot
|
||||||
License: GPL
|
License: GPL
|
||||||
BuildPrereq: /usr/bin/perl
|
BuildRequires: /usr/bin/perl
|
||||||
|
BuildRequires: libselinux-devel
|
||||||
Conflicts: kernel < 2.4.20
|
Conflicts: kernel < 2.4.20
|
||||||
Requires(post,postun): chkconfig
|
Requires(post,postun): chkconfig
|
||||||
Prefix: %{_prefix}
|
Prefix: %{_prefix}
|
||||||
@ -67,6 +69,7 @@ rm -rf %{buildroot}
|
|||||||
%patch8 -p1 -b .cleanup
|
%patch8 -p1 -b .cleanup
|
||||||
%patch9 -p1 -b .autoload
|
%patch9 -p1 -b .autoload
|
||||||
%patch10 -p1 -b .no_root
|
%patch10 -p1 -b .no_root
|
||||||
|
%patch11 -p1 -b .secmark
|
||||||
|
|
||||||
# Put it to a reasonable place
|
# Put it to a reasonable place
|
||||||
find . -type f -exec perl -pi -e "s,/usr/local,%{prefix},g" {} \;
|
find . -type f -exec perl -pi -e "s,/usr/local,%{prefix},g" {} \;
|
||||||
@ -79,6 +82,7 @@ perl -pi -e "s/^_init\(/__attribute\(\(constructor\)\) my_init\(/g" extensions/*
|
|||||||
%build
|
%build
|
||||||
TOPDIR=`pwd`
|
TOPDIR=`pwd`
|
||||||
OPT="$RPM_OPT_FLAGS -I$TOPDIR/include -fPIC"
|
OPT="$RPM_OPT_FLAGS -I$TOPDIR/include -fPIC"
|
||||||
|
export DO_SELINUX=1
|
||||||
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib}
|
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib}
|
||||||
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib} iptables-save iptables-restore
|
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib} iptables-save iptables-restore
|
||||||
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib} ip6tables-save ip6tables-restore
|
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib} ip6tables-save ip6tables-restore
|
||||||
@ -151,6 +155,9 @@ fi
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Sep 19 2006 Thomas Woerner <twoerner@redhat.com> 1.3.5-2
|
||||||
|
- added secmark iptables patches (#201573)
|
||||||
|
|
||||||
* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.3.5-1.2.1
|
* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.3.5-1.2.1
|
||||||
- rebuild
|
- rebuild
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user